CVE-2022-31668
High
Description
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.
SeverityHigh
CVSS7.4
Exploit probability—
Product
Linuxfoundation Harbor
PublishedNov 14, 2024
First seenNov 14, 2024
Weakness typeCWE-285CWE-285
How to fix
Update
- linuxfoundation harbor2.4.3, 2.5.2 or later
- github.com/goharbor/harbor2.4.3, 2.5.2, 2.4.3+incompatible, 2.5.2+incompatible or later
- github.com/goharbor/harbor/src0.0.0-20220630175814-b4ef1db or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation harbor | 2.0.0 ≤ v < 2.4.3, 2.5.0 ≤ v < 2.5.2 | 2.4.3, 2.5.2 |
| github.com/goharbor/harborGo | 2.0.0 ≤ v < 2.4.3, 2.5.0 ≤ v < 2.5.2, 2.0.0+incompatible ≤ v < 2.4.3+incompatible, 2.5.0+incompatible ≤ v < 2.5.2+incompatible | 2.4.3, 2.5.2, 2.4.3+incompatible, 2.5.2+incompatible |
| github.com/goharbor/harbor/srcGo | v < 0.0.0-20220630175814-b4ef1db | 0.0.0-20220630175814-b4ef1db |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.